Application Security
ASVS 5.0 V14.2.1: No Sensitive Data in URLs or Queries
ASVS 5.0 V14.2.1 (Level 1): send secrets in the body or headers, never the URL. Code fixes, a log search test and mistakes to avoid.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedApplication Security
ASVS 5.0 V14.1.2: Document Protection Requirements
ASVS 5.0 V14.1.2 (Level 2): each data protection level needs written requirements for encryption, retention, logging and access. What to include.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V14.1.1: Identify and Classify Sensitive Data
ASVS 5.0 V14.1.1 (Level 2): find all sensitive data, including Base64 strings and JWT payloads, and assign protection levels. A practical way to start.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V13.4.7: Serve Only Allowed File Extensions
ASVS 5.0 V13.4.7 (Level 3): the web tier should serve only files with approved extensions, so backups and configs never leak. Allowlist examples.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V13.4.6: Do Not Reveal Backend Versions
ASVS 5.0 V13.4.6 (Level 3): responses should not expose detailed backend component versions. Header and banner settings that fix it.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V13.4.5: Hide API Docs and Monitoring Endpoints
ASVS 5.0 V13.4.5 (Level 2): internal API docs and monitoring endpoints must not be exposed by accident. Config, tests and common leaks.
Oct 18, 20263 min read
Application Security
ASVS 5.0 V13.4.4: Disable the HTTP TRACE Method
ASVS 5.0 V13.4.4 (Level 2) says production must not support HTTP TRACE. How to turn it off in common servers and prove it with curl.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V13.4.3: Do Not Expose Directory Listings
ASVS 5.0 V13.4.3 (Level 2): web servers must not list directory contents unless you meant them to. The config switches and a one line test.
Oct 18, 20262 min read
Application Security
ASVS 5.0 V13.4.2: Turn Debug Modes Off in Production
ASVS 5.0 V13.4.2 (Level 2) requires debug features disabled on every production component. Config examples, a test plan and the usual misses.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.